On 12 October 2026, at an event in Abuja organised by the African Girl Guild for the International Day of the Girl Child, the EFCC warned young women about sextortion and about lending their bank accounts to "Yahoo boy" fraudsters. Chairman Ola Olukoyede's message was read by Aisha Muhammed, head of the agency's Enlightenment and Re-orientation Unit. TVC News reported that she told the audience an account in a girl's name "can take you to prison", and that criminals use intimate images and personal information to blackmail victims.
The strongest case for the warning
The case for this kind of outreach is solid. Money mules are the choke point of online fraud: a fraudster who cannot move money gains nothing from the scam. Young women who rent out or lend an account often do not know they carry criminal liability. An agency that explains that risk before prosecution is doing prevention, which is cheaper and fairer than punishment after the fact. Warning potential sextortion victims to seek help early is also sound.
The weakness is the framing. The warning places the duty on individuals, many of them teenagers, while the infrastructure that makes the crime profitable (social platforms, payment rails, bank onboarding) is regulated through separate instruments.
What disruption actually looks like in 2026
The same week produced a telling comparison. The Record reported on 13 October that a UK-hosted "Joint Disruption Week" brought together 15 law enforcement agencies and 15 technology companies, including Meta, Microsoft and Google. Police in Ghana and Nigeria arrested or detained 28 people. Ghanaian police identified 117 suspected trafficking victims and 89 scam victims who had lost an estimated $8.3 million. Participating companies removed more than 3.7 million accounts, pages and groups linked to West African scam centres, according to the US Department of Justice.
That is the pattern of what works. An earlier US-led round, announced by the Justice Department on 3 June 2026, disrupted more than 1.4 million social media and email accounts and froze over $3.8 million in cryptocurrency through private-sector action after government information sharing. The account removals dwarf the arrest counts. Nine arrests in Nigeria sit against millions of accounts. Meta's 2024 removal of about 63,000 Nigeria-based Instagram accounts tied to Yahoo Boys financial sextortion, reported by NBC News, points the same way: platform-side detection scales in a way awareness campaigns and individual prosecutions cannot.
Where the NCC code fits
Nigeria's domestic rulebook for platforms is the Internet Code of Practice 2026, which the Nigerian Communications Commission published on 13 February 2026. According to the Digital Policy Alert tracker, it entered a grace period on 15 May 2026 and entered into force on 13 August 2026. The code reaches beyond internet access providers to user-generated content platforms, e-commerce platforms and cloud providers, with stated aims that include child protection and limits on harmful content. Sources differ on exactly when the code took effect, and I could not read its full operative clauses in machine-readable form, so firms should check the NCC text directly for their specific duties.
The question for a pro-innovation regulator is whether the code is used to build the cooperation channels that the October operation relied on, or to widen takedown discretion. Reporting, trusted-flagger routes and clear evidence-sharing with law enforcement are proportionate, and they produce measurable results. Open-ended content-removal powers risk chilling lawful speech, and Nigeria's 2024 amendment to the Cybercrimes Act is already contested over vague speech offences. Fraud and sextortion are crimes with identifiable victims and financial trails. They are best fought with narrow, evidence-based tools, not broad content mandates.
A proportionate agenda
- Target the money. Mule recruitment depends on easy account opening and weak transaction monitoring. Risk-based bank checks, with clear liability rules, will reduce supply more than public warnings alone.
- Protect the reporter. Girls who report sextortion should be treated as victims. If the same message that warns them about prosecution deters them from coming forward, enforcement agencies lose their best intelligence.
- Keep platform duties narrow and procedural. Require fast action on notified child-abuse and fraud content, with appeal routes, instead of general monitoring. The code's design should preserve lawful speech.
- Publish the numbers. The 3.7 million account figure was not broken down by company. Regulators and platforms should report removals, appeals and reinstatements so the public can judge whether takedowns are accurate.
The bottom line
The EFCC's message is well meant and the underlying advice is correct. But the October data show where leverage lies: cross-border cooperation between agencies, banks and platforms removed millions of accounts, while arrests in Nigeria numbered in single digits. Nigeria can protect its young people and its open internet best by funding that cooperation and keeping the NCC's rules precise, rather than leaning on outreach to individual girls to carry a burden that belongs to the system.